Apple Silicon Mac: APFS data lost after disk full

momo-des wrote:

# APFS Metadata Loss After Disk Reached 0 Bytes Free – Apple Silicon with FileVault – User Data Suddenly Missing

Bad things can happen when there is no Free storage space. After all there is no way to save any data at that point.

My internal disk reached **0 bytes of free space**. After restarting the Mac, macOS behaved as if it were a brand-new installation:

- My user folder appeared empty

I've never seen or even heard of this occurring before.

- Desktop and Documents folders were missing

If iCloud was being used, I know it affects how the Desktop & Documents are seen, but I'm not sure on the specifics since I don't use iCloud this way.

Most surprisingly, the system suddenly reported approximately **300 GB of free space**, whereas previously I had about **180 GB of user data** stored.

This leads me to believe that the data blocks were deallocated or that APFS metadata became corrupted after the disk filled completely, rather than this being a hardware failure or authentication issue. I still have full access to the Mac and my FileVault password.

Something definitely seems to have happened where something actually deleted all the data, or the file system was corrupted causing a loss of the folder structure & stored data.

Unfortunately, I used the Mac for approximately three hours before realizing the severity of the issue. During that time:

- I installed Disk Drill

- I performed a disk scan

- New system and application data were written

You should not use the drive that requires data recovery. You need to run data recovery software from an external drive to attempt to retrieve data from the internal boot drive. Otherwise you are overwriting the data you are trying to recover. If Disk Drill could not find anything with a deep scan, then there is nothing left to recover.

## Data I Am Trying to Recover

- C source files and programming projects

- KiCad PCB design projects

- Markdown files (`.md`)

- PDF documents

- Word documents (`.docx`)

I hope you have good backups from before this issue occurred. Otherwise this data is likely gone unless you can find other copies elsewhere.

There are a lot more new ways to permanently lose access to the data stored on the internal SSD of the recent Macs due to all of the hardware, software, and security changes. People should always have frequent & regular backups of their computer and all external media (including the cloud) which contains important & unique data.

1. In a scenario like this (Apple Silicon + FileVault + APFS + some disk activity after the incident), is there any realistic possibility that the data still exists at the block level?

Unlikely especially if you have been booting to the "damaged" drive.

2. On Apple Silicon, once APFS deallocates blocks and TRIM potentially runs, is logical recovery still feasible?

No.

3. Has anyone experienced similar behavior after a disk reached 0 bytes of free space?

With the HFS+ file system I know a co-worker discovered that the files became corrupted.

With the APFS file system, all I have ever seen is that it is impossible to write any more data to the affected volume. This also means it is impossible to delete any files on that volume due to how the APFS file system works. The APFS file system must have enough space to write the main data which it does first. Then as a final step, a small link is created in the directory structure to point to the new data....this is meant to prevent file system corruption.

I've never seen anyone report what you have described. I'm not even sure how that can even occur without affect the whole folder structure within your home user folder.

I understand that Apple Silicon integrates the SSD controller and Secure Enclave, which prevents traditional NAND extraction methods. I am trying to determine whether this type of incident is considered technically recoverable, even partially, or generally irreversible.

If as soon as you realized the data was gone you had powered off the computer, then maybe a very slim chance a professional data recovery service may have been able to do something, but I doubt. If the file system became corrupted, then maybe the data would still be there since it may not have triggered any deletion event. And now, I would not expect any data to be recoverable from that internal SSD. If something triggered a deletion event, then I would expect the data to be gone & inaccessible. You can always contact a professional data recovery service to see what they have to say about the situation. Some may just charge a small diagnostic fee (or nothing at all) if the data is not recoverable depending on what is required for them to get the current state of the SSD & file system.

There is no realistic expectation that you can "salvage" anything from an encrypted, TRIM-enabled SSD, that experienced a Disk Full event.

¿What is the date of your most recent backup and by what method?

momo-des wrote:

## Technical Question

Given this additional context, does this behavior suggest:

- APFS container or metadata corruption?

- A failed or partially triggered system update?

- A home directory unlinking event?

- A sync issue related to Apple ID / iCloud?

- Or a full metadata reset triggered by the disk full condition?

I am trying to determine whether this scenario aligns more with APFS metadata failure, an authentication/sync issue, or an actual deletion event at the file system level.

Thank you again for any technical insight.

None of that changes anything. The AppleID/iCloud issue was likely due to the system running out of storage space. I didn't think you accidentally deleted anything either.

Your only hope of data recovery would be if the items disappeared because of a file system issue breaking the directory structure because that would not be deleting data so it would not trigger a rewrite of the affected NAND blocks meaning Disk Drill should be able to find the data with a deep/thorough scan if this is what occurred.

I don't know of anything else that would give you hope for the data still being accessible to recover. And from what you have described of what remains in your home user folder, I cannot think of anything that could do that....delete your data & leave the other folders untouched. I doubt even if I had physical access to your Mac that we would be able to know what occurred, but we definitely cannot tell remotely.

I've never seen or heard of anything remotely similar for any system or OS.

It seems there is nothing you can do about it now anyway except learn from the mistakes made here. Never let your computer get below 20% Free storage space (ignore the "Available" storage value), and always have frequent & regular backups. The more important the data, the more backups you should have...and perhaps even backup using two different methods so if one method fails, hopefully the other method/backup doesn't have a problem. And take the macOS warnings seriously when they appear....usually when those warnings appear you are already almost too late to deal with them in a simple manner.

I really wish we could help you recover the data, but all we can suggest is for you to look for copies of any data you may have placed on other media or even email, or was the data being synced to the cloud, etc. FYI, cloud file syncing services such as iCloud are not a backup method for a computer. In fact, you need to make sure you backup whatever data is being synced to the cloud as well.

And I agree with everything @Grant has posted here.

[In my opinion] Speculation about what may or may not have happened to your drive when you wrote more data to it than it could hold is a waste of effort. no one knows for certain.

What we DO know:

ANY writes you do to run from or copy files to the damaged drive reduces the chances of rescuing things. Anything you "rescue" MUST go to a completely different drive.

Since you did not answer:

¿What is the date of your most recent backup, and by what method?

then I presume you have none.

This will be a tough lesson, but you will never fail to make backups again.

Find/Buy an external drive at least two to three times the size of what you needed to backup before this mess. if using built-in Time Machine, do not pay extra for a drive that is FAST.

Find/Buy an external drive to use for recovering and holding your many files. it must be larger than your original boot drive.

Then, boot into Recovery, and login with your Admin credentials, IF THEY STILL EXIST.

attach an external drive and ERASE it.

Install a new instance of the same version of MacOS you were running, But onto that external drive,

and then boot from that external drive.

Once that is settled, THEN you can look back at the mess that used to be your internal boot drive.

How to use an external storage device as a Mac startup disk

https://support.apple.com/en-us/111336